CVE-2023-48312
📋 TL;DR
CVE-2023-48312 is a privilege escalation vulnerability in capsule-proxy that allows unauthenticated users to bypass token review mechanisms and interact with the Kubernetes API Server. This affects clusters with anonymous-auth disabled in the Kubernetes API Server configuration. The vulnerability cannot be exploited if relying solely on client certificate authentication.
💻 Affected Systems
- capsule-proxy
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full administrative access to the Kubernetes cluster, allowing them to deploy malicious pods, exfiltrate sensitive data, or disrupt cluster operations.
Likely Case
Unauthorized users escalate privileges to interact with Kubernetes resources they shouldn't have access to, potentially compromising tenant isolation in multi-tenant environments.
If Mitigated
If proper network segmentation and authentication controls are in place, impact is limited to unauthorized API calls within the allowed network perimeter.
🎯 Exploit Status
Exploitation requires sending requests to capsule-proxy without proper authentication tokens, taking advantage of missing TokenReview result validation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 0.4.6
Vendor Advisory: https://github.com/projectcapsule/capsule-proxy/security/advisories/GHSA-fpvw-6m5v-hqfp
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update capsule-proxy to version 0.4.6 or later using your package manager or container registry. 3. Restart the capsule-proxy service. 4. Verify the new version is running.
🔧 Temporary Workarounds
Enable anonymous-auth in Kubernetes API Server
linuxTemporarily enable anonymous authentication in the Kubernetes API Server configuration to prevent exploitation
kubectl edit configmap -n kube-system kube-apiserver
Set --anonymous-auth=true in the configuration
Network isolation
linuxRestrict network access to capsule-proxy to only trusted sources
iptables -A INPUT -p tcp --dport <capsule-proxy-port> -s <trusted-ip> -j ACCEPT
iptables -A INPUT -p tcp --dport <capsule-proxy-port> -j DROP
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach capsule-proxy endpoints
- Enable client certificate authentication exclusively and disable token-based authentication
🔍 How to Verify
Check if Vulnerable:
Check capsule-proxy version and verify if running version <0.4.6. Also check Kubernetes API Server configuration for anonymous-auth=false.Check Version:
capsule-proxy --version or check container image tagVerify Fix Applied:
Confirm capsule-proxy version is 0.4.6 or later and test that unauthenticated requests are properly rejected.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to capsule-proxy
- Failed TokenReview validations
- Unexpected API calls from unauthenticated sources
Network Indicators:
- Unusual traffic patterns to capsule-proxy from unexpected sources
- API requests without proper authentication headers
SIEM Query:
source="capsule-proxy" AND (event="unauthorized" OR event="authentication_failed")🔗 References
- https://github.com/projectcapsule/capsule-proxy/commit/472404f7006a4152e4eec76dee07324dd1e6e823
- https://github.com/projectcapsule/capsule-proxy/security/advisories/GHSA-fpvw-6m5v-hqfp
- https://github.com/projectcapsule/capsule-proxy/commit/472404f7006a4152e4eec76dee07324dd1e6e823
- https://github.com/projectcapsule/capsule-proxy/security/advisories/GHSA-fpvw-6m5v-hqfp
